Scope: Distro-independent; applies to ext4, XFS, and other standard Linux filesystems
Topics: ls -l output, ugo and rwx, chmod notation, ownership with chown and chgrp, umask, SUID, SGID, sticky bit, ACLs, and verification.

Main Flow#

1. Read the Permission String#

List the file details:

ls -l <FILE>

Expected output:

-rwxr-xr-- 1 alice devops 2048 Mar  5 10:00 report.sh

Break down the output:

• -rwxr-xr--: Permission string.
• 1: Hard link count.
• alice: Owner (user).
• devops: Owning group.
• 2048: Size in bytes.
• Mar 5 10:00: Last modification time.
• report.sh: File name.

Read the permission string as follows:

• Character 1: File type. - is a regular file, d is a directory, l is a symbolic link.
• Characters 2-4: Owner permissions, rwx.
• Characters 5-7: Group permissions, rwx.
• Characters 8-10: Other permissions, rwx.

2. Understand ugo and rwx#

Three classes of users and three permissions combine into nine permission bits:

Directory write access without execute is meaningless, and execute without read allows access to known names but no listing.

3. Change Permissions with Symbolic Notation#

Add execute permission for the owner:

chmod u+x <FILE>

Remove write permission for group and other:

chmod go-w <FILE>

Set exact permissions for all classes:

chmod u=rwx,g=rx,o=r <FILE>

Apply recursively to a directory tree:

chmod -R g+rw <DIRECTORY>

Options:

• u, g, o, a: Select owner, group, other, or all classes.
• +, -, =: Add, remove, or set permissions exactly.
• r, w, x: Select the read, write, and execute permissions.
• -R: Applies the change recursively. Use with care.

4. Change Permissions with Octal Notation#

Each class receives one octal digit. The digit is the sum of its permission values:

Add the values together to build one digit:

Read the three digits as owner, group, other:

chmod 750 <FILE>

Expected result: rwxr-x--- for owner alice, group devops.

Each digit is calculated independently: the leading 7 is 4 + 2 + 1 (rwx) for the owner, the 5 is 4 + 1 (r-x) for the group, and the 0 grants no permissions to other.

Common combinations:

5. Change Ownership#

Change the owner and group of a file:

chown <USERNAME>:<GROUP_NAME> <FILE>

Change only the group:

chgrp <GROUP_NAME> <FILE>

Apply recursively to a directory tree:

chown -R <USERNAME>:<GROUP_NAME> <DIRECTORY>

Options:

• <USERNAME>: New owning user.
• <GROUP_NAME>: New owning group.
• -R: Applies the change recursively.

Only root can change the owning user. A group owner can change the group to any of their own groups.

6. Set the Default umask#

The umask subtracts permissions from the defaults of 666 for files and 777 for directories. Display the current value:

umask

Expected output:

0022

With umask 022, new files are created as 644 and new directories as 755. With umask 077, new files are created as 600 and new directories as 700.

Set the umask for the current session:

umask 077

Make it persistent for a user in ~/.bashrc:

umask 077

Set the system default for new logins in /etc/login.defs:

UMASK 022

7. Apply Special Bits#

The three special bits occupy the first octal digit or replace the execute letter in the permission string.

The special bits use the same value logic as the permission digits, applied in the fourth (leading) octal position: SUID adds 4, SGID adds 2, and the sticky bit adds 1. This is why their octal values are 4000, 2000 and 1000.

The values add up like the permission digits: a leading digit of 7 (4 + 2 + 1) sets SUID, SGID and the sticky bit at the same time, while a leading digit of 6 (4 + 2) sets SUID and SGID without the sticky bit.

Set SUID on a script owner:

chmod u+s <FILE>
chmod 4755 <FILE>

Set SGID on a shared project directory so new files keep the group:

chmod g+s <DIRECTORY>
chmod 2775 <DIRECTORY>

Set the sticky bit on /tmp:

chmod 1777 /tmp

Expected result: drwxrwxrwt. Every user can create files in /tmp, but users can only delete their own files. This is the standard protection for world-writable directories.

SUID on scripts is ignored by most kernels for security reasons. Restrict SUID to vetted compiled binaries such as /usr/bin/passwd.

8. Configure ACLs#

Access control lists grant permissions to specific users or groups beyond the ugo model. Check the ACL tools first:

getfacl <FILE>
setfacl --version

Grant read access to a single user:

setfacl -m u:<USERNAME>:r <FILE>

Grant read and execute access to a group on a directory:

setfacl -m g:<GROUP_NAME>:rx <DIRECTORY>

Set a default ACL so new entries inherit it:

setfacl -d -m g:<GROUP_NAME>:rx <DIRECTORY>

Remove an ACL entry:

setfacl -x u:<USERNAME> <FILE>

Options:

• -m: Modifies the ACL.
• -x: Removes an ACL entry.
• -d: Applies the rule as a default ACL on a directory.
• -R: Applies the rule recursively.

Files with ACLs show a + at the end of the permission string in ls -l. Use getfacl to read the full effective permissions.

9. Verify the Result#

Inspect the effective permissions:

ls -l <FILE>
getfacl <FILE>
stat -c '%A %U:%G %n' <FILE>

Expected output for stat:

-rwxr-x--- alice devops report.sh

Check directory traversal on the full path:

namei -l <PATH>

Every directory component on the path requires execute permission for the accessing account, otherwise the final file permissions do not matter.

Part 3: Important Notes#

Permission Evaluation Order#

• ACLs are checked first. If a matching user or group ACL entry exists, it determines the outcome.
• Otherwise, the ugo bits apply: owner, then group, then other.
• The most specific match wins, so an owner ACL entry overrides the group mask.

Symbolic vs. Octal Notation#

Prefer symbolic notation for single-bit changes and octal notation when setting a complete, well-understood permission set.

Command Reference#

Security Guidelines#

• Replace placeholders such as <FILE>, <USERNAME>, and <GROUP_NAME> with actual values. Do not include the angle brackets in commands.
• Set a restrictive umask such as 077 on accounts that handle credentials or private keys.
• Never use chmod 777. It grants write access to every account and is never a fix for permission problems.
• Avoid chmod -R on system paths. Recursive changes are difficult to reverse and can break services.
• Do not set SUID on scripts or interpreters. SUID means the file runs with its owner’s privileges, so any flaw becomes a privilege escalation path.
• Keep /tmp and other shared directories at 1777 with the sticky bit set.
• Remove ACL entries when they are no longer needed. ACLs override the ugo bits and are easy to forget during audits.
• Verify ownership and permissions after every change with ls -l, getfacl, or stat.
• Grant group access through a dedicated group per project instead of widening permissions for other users.
• When logged in as root, the commands above do not require the sudo prefix.